CVE-2023-6874
Silabs Gecko Software Development Kit ≤ 4.4.0
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2023-6874 is a high-severity Cleartext Storage of Sensitive Information (CWE-312) vulnerability in Silabs Gecko Software Development Kit. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Junk Data (T1001.001); ranked at the 27th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SC-28 (Protection of Information at Rest) — see the control section below for these in your framework.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-59078
Vulnerability Data
Prior to v7.4.0, Ember ZNet is vulnerable to a denial of service attack through manipulation of the NWK sequence number
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
- 4 hardening rules · 3 OS baselines
V14.2.8
Mitigating Controls (NIST 800-53 r5) AI
SC-28 requires cryptographic or equivalent protection of sensitive data at rest, directly stopping cleartext storage in accessible resources.
Developer testing and evaluation explicitly exercises unusual conditions to find missing or incorrect checks.
Input validation directly requires checking for unexpected or malformed conditions before they propagate.
Security engineering principles include structured handling of edge cases and exceptions during design.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Encryption and cryptographic controls for data-at-rest directly prevent cleartext storage of sensitive information.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
When clear-text sensitive data is detected leaving controlled storage, the control can block the transfer, thereby limiting the exposure that would result from unencrypted storage on external media or cloud services.
Logging can record unhandled exceptions but does not prevent the weakness itself.
Monitoring may detect symptoms of unhandled conditions but does not eliminate the root weakness.
created from the owner's anchor; an owner grade is a row and does not wait for an instrument (Mythos 2026-09-29T15:58Z).
Secure development life cycle mandates exception handling and input validation that directly prevent missing checks for unusual conditions.
Application security requirements explicitly call for handling of exceptional conditions and error paths.
Hardening callouts derived
Configuration rules from DISA STIG baselines that bear on weaknesses of the type cited by this CVE. Each rule is shown with the relationship its mapping actually records, against the CWE it was authored against. Derived via CVE→CWE over `controls_xwalks` (higher-evidence rows only; rows rated `none` are excluded).
Oracle Linux 8 (1 rule)
- V-248525 All OL 8 local disk partitions must implement cryptographic mechanisms to prevent unauthorized disclosure or modification of all information that requires at-rest protection. blocks CWE-312
Oracle Linux 9 (1 rule)
- V-271756 OL 9 local disk partitions must implement cryptographic mechanisms to prevent unauthorized disclosure or modification of all information that requires at rest protection. blocks CWE-312
RHEL 8 (1 rule)
- V-230224 All RHEL 8 local disk partitions must implement cryptographic mechanisms to prevent unauthorized disclosure or modification of all information that requires at rest protection. blocks CWE-312